Privacy Notice

This Notice explains the processing of personal data by the Payfux service provider identified on this page. It applies to business representatives, beneficial owners, authorised users, applicants, payers or beneficiaries where their data enters an enabled payment flow, support contacts, and website visitors.

The company identity supplied for publication remains subject to registry-document verification. Privacy requests may be sent to [email protected]. The service address appears at the end of this page.

• Account and contact data: name, business role, company, email, telephone, language, timezone, authentication and account status.
• Corporate and due-diligence data: registration, ownership, beneficial owners, representatives, licences, source-of-funds information, sanctions and verification results.
• Identity evidence: identification and proof-of-address data only where a purpose-specific secure upload is expressly enabled.
• Service and transaction data: customer references, payment or wallet instructions, asset, network, address, amount, timestamps, status, fees, related business records, and support history.
• Bankroll application data: operating history, requested facility, intended use, payment and payout statistics, financial statements, processing records, contact preference, declarations, and review history.
• Technical data: IP address, browser and device details, session events, error and audit records, and essential preference storage.

Until the Bankroll page confirms that its private document channel is operational, do not send identity or company documents by ordinary email, chat, or WhatsApp.

Data may come directly from the person or business customer, from an authorised integration, from payment and blockchain records, from corporate and public registers, from sanctions or risk-data providers, from service providers involved in an instruction, or from another party where law permits and notice is provided as required.

A form identifies required fields. Account identity, authority, compliance, instruction, and contract fields are generally required to provide the requested service. If they are not provided, Payfux may be unable to open an account, process an instruction, review an application, or meet a legal duty.

Contact preferences, preferred call time, free-text context, and marketing permission are optional unless a form explains a specific operational need. Marketing consent must not be bundled with a Bankroll or service request and may be withdrawn without affecting the underlying request.

Company, ownership, identity, financial, and licence documents are used only for the stated underwriting, verification, fraud-prevention, legal, and contact purposes. Before upload, the interface must state the document category, accepted formats and limits, whether it is required, likely recipients, retention criteria, and the effect of refusal.

The upload service remains unavailable unless private encrypted storage, restricted role-based access, authenticated retrieval, audit records, deletion procedures, processor terms, incident handling, and a Costa Rican database-registration assessment are operational. Files are never published through a public media URL.

Data may be disclosed, only as necessary for the purpose, to hosting and infrastructure providers, communications providers, payment and settlement providers, identity and risk-verification providers, professional advisers, auditors, financing reviewers, and an approved prospective financing party identified before disclosure.

Payfux may also disclose data to courts, regulators, financial-intelligence or law-enforcement authorities where legally required, or in a documented corporate transaction subject to appropriate confidentiality and continuity protections. Payfux does not sell identity or Bankroll documents.

Some processors or recipients may be outside Costa Rica. Before a transfer requiring permission, Payfux will identify the recipient or recipient category, destination, purpose, and relevant protection and obtain informed consent unless another legal basis expressly permits the transfer. Contractual, access, confidentiality, and technical safeguards are applied according to risk and applicable law.

Data is kept only for the purpose stated and under a documented schedule. Draft applications and documents are removed when no longer needed for the review, subject to fraud, legal-hold, audit, or dispute requirements. Accepted transaction, accounting, compliance, and contract records may be retained for the period required by applicable law.

Unless a special law, regulator, active contract, claim, preservation duty, or documented exception requires a different period, personal data is deleted or anonymised no later than ten years after its purpose ends. Backup copies expire through controlled rotation rather than being used for new purposes.

Subject to applicable law, a person may request confirmation of processing; access to their data and its source; correction of inaccurate or incomplete data; deletion or blocking where processing is unlawful or no longer justified; and revocation of consent. A person may also object to optional marketing and ask about recipients and retention.

Send the request from a contact method that can be safely verified. Payfux may request proportionate identity evidence, will not use it for another purpose, and will respond within the period required by law. Revocation does not invalidate processing already lawfully completed and may prevent a requested service where the data is necessary.

Payfux applies controls appropriate to the sensitivity and purpose of data, including access restriction, authentication, encryption for sensitive stored documents, transport protection, auditability, retention controls, and confidentiality duties. No system can remove every risk. Where applicable law requires notice of an incident affecting personal data, Payfux will notify the appropriate authority and affected persons as required.

Risk, fraud, activity, or eligibility signals may help prioritise a review, but a Bankroll request does not receive funding automatically. Material adverse underwriting decisions should be reviewed under the applicable policy and communicated without revealing information that law prohibits Payfux from disclosing.

Payfux business accounts are not directed to children. Business customers must not send children's personal data unless the enabled service, applicable law, and a written data-processing arrangement expressly permit it. Customers remain responsible for their own privacy notices and lawful instructions concerning their players, purchasers, or other end users.

Send privacy requests or complaints to [email protected] with the subject “Privacy”. You may also contact Costa Rica's data-protection authority, the Agencia de Protección de Datos de los Habitantes (PRODHAB), where you believe your rights under Law 8968 have not been respected.

This Notice may be updated when purposes, processors, law, or products change. A material change will be notified where required and a new consent will be requested when the new purpose is incompatible with the consent already given.